Suspected CLs	The result is a list of CLs that change the crashed files.

Author: thestig
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/8bc9b8b2ddeb3ffa904d8f35039550c55706ba86
Time: Wed Oct 12 09:59:35 2016 -0700
Lines 221-228 of file fpdf_page_func.cpp which potentially caused crash are changed in this cl (frame #3, "CPDF_PSEngine::DoOperator").
Minimum distance from crash line to modified line: 0. (file: fpdf_page_func.cpp, crashed on: 221, modified: 221).

Suspected Project: chromium-pdfium


thestig@: Could you please take a look at this.

Thanks in advance!

tsepez: Is this a safe_math_impl bug?

Yeah, sorta.  Safe math, in order to be nimble, doesn't always branch around undefined behavior (looks like a div by zero in this case), instead just flags the result as invalid but carries out the operation.

Looks like this is fixed in base, but not in PDFium's copy.  We should figure out a way to periodically update this.

Anyways, I'll just do a manual update for now while we think about it.

CL at https://codereview.chromium.org/2441753003/

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/08e9df3cf85451cac4cc82bafe816fa741b7a110

commit 08e9df3cf85451cac4cc82bafe816fa741b7a110
Author: pdfium-deps-roller <pdfium-deps-roller@chromium.org>
Date: Fri Oct 21 21:58:42 2016

Roll src/third_party/pdfium/ fd5ae3f7c..a804fd48b (2 commits).

https://pdfium.googlesource.com/pdfium.git/+log/fd5ae3f7cf07..a804fd48b716

$ git log fd5ae3f7c..a804fd48b --date=short --no-merges --format='%ad %ae %s'
2016-10-21 tsepez Fix some div by 0s in safe_math_impl.h
2016-10-21 npm Clean up fpf_skiafontmgr

BUG= 657436 

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, see:
http://www.chromium.org/developers/tree-sheriffs/sheriff-details-chromium#TOC-Failures-due-to-DEPS-rolls

TBR=dsinclair@chromium.org

Review-Url: https://chromiumcodereview.appspot.com/2432043009
Cr-Commit-Position: refs/heads/master@{#426907}

[modify] https://crrev.com/08e9df3cf85451cac4cc82bafe816fa741b7a110/DEPS

ClusterFuzz has detected this issue as fixed in range 426853:426922.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4721544888844288

Fuzzer: libfuzzer_pdf_psengine_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Floating-point-exception
Crash Address: 
Crash State:
  _ZN6pdfium4base8internal10CheckedModIiEENSt3__19enable_ifIXaasr3std14numeric_lim
  _ZN6pdfium4base8internalrmIiEENS1_14CheckedNumericINS1_19ArithmeticPromotionIT_S
  pdfium::base::internal::CheckedNumeric<int>& pdfium::base::internal::CheckedNume
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=424750:424825
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=426853:426922

Minimized Testcase (1.95 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97UOHONWl2gPQVdItEYoDeNXxNRFofkhPJavLcotmKIr_sQMnGUKhfScvc3vqrva9MnFE_LTsVuyavEKtgwX6Thg-MICcSmjVpmmDU6-jj9DjSmlPMLJDSyiXhcgUM54miTXytEGxyzcj9JUYWF7z7DaI-Y9g?testcase_id=4721544888844288

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot